📘 IT Certification Handbook

1. Microsoft 365 Admin Center – Getting Started MS-900

The Microsoft 365 Admin Center is the main website where IT administrators go to manage users, licenses, security settings, and devices for their company. Think of it as the "control room" for your organization's Microsoft services.

How to access it

Go to admin.microsoft.com and sign in with your administrator account.

What you can do here

• Add and remove users – Create new employee accounts
• Assign licenses – Give users access to Microsoft 365 apps like Word, Excel, Teams
• Reset passwords – Help users who forgot their login
• Manage groups – Organize users into departments (Sales, Finance, IT, etc.)
• Monitor services – See if Microsoft 365 services are running normally
• Access other admin centers – Links to Intune, Entra, Exchange, SharePoint, etc.

Licensing Explained Simply

A license is like a ticket that allows a user to use a Microsoft service. Common license types include:

• Microsoft 365 Business Basic – Email (Exchange), Teams, SharePoint, OneDrive (web & mobile apps only)
• Microsoft 365 Business Standard – Everything in Basic + desktop versions of Office apps (Word, Excel, PowerPoint, Outlook)
• Microsoft 365 E3/E5 – Enterprise-grade licenses with advanced security, compliance, and analytics features
• Microsoft 365 F3 – For frontline / shift workers with limited needs

↑ Back to Index

2. Creating & Managing Users MS-900

How to Create a New User (Step by Step)

1. Go to admin.microsoft.com → Users → Active Users
2. Click "Add a user"
3. Fill in:
   • First name and Last name (e.g., Samantha Rogers)
   • Display name – How they appear in the company directory (e.g., "Samantha Rogers")
   • Username – This becomes their email address (e.g., samantha@company.com)
4. Set a password – You can auto-generate one or create your own. Check "Require user to change password on first sign-in" for security.
5. Assign a license (or skip this if you need manager approval first)
6. Set roles – Most users are regular users with no admin access. Only give admin roles to IT staff.
7. Fill in profile info (optional): title, department, office location, phone number, etc.
8. Click "Finish adding"

Using Templates

If you hire many people for the same role (e.g., "Financial Analyst"), you can save a template with all the common settings. Next time, just pick the template and fill in the name – saves a lot of time!

Managing Existing Users

• Reset password – Under the user's account, select "Reset password"
• Change/assign licenses – From the user's profile, go to "Licenses and apps"
• Block sign-in – Immediately stops the user from accessing anything (useful when someone leaves the company)
• Delete user – Removes the account. Deleted users are kept for 30 days in case you need to restore them.

↑ Back to Index

3. Microsoft Entra ID (formerly Azure AD) MS-900

What is Entra ID?

Microsoft Entra ID (pronounced "en-tra") is the cloud-based identity and access management service. It used to be called Azure Active Directory (Azure AD). Microsoft renamed it in 2023, but you'll still see the old name in many places – don't let that confuse you!

What does Entra ID do?

• Stores user identities – All the usernames, passwords, and security info
• Controls who can access what – You decide which apps and services each user can use
• Manages authentication – Handles the login process, including MFA (multi-factor authentication)
• Syncs with on-premise Active Directory – If your company has a traditional server-based Active Directory, you can connect (sync) it with Entra ID. This is called a hybrid setup.

Where to find Entra ID

Go to entra.microsoft.com or find it under "Identity" in the Microsoft 365 Admin Center.

↑ Back to Index

4. Multi-Factor Authentication (MFA) MS-900

What is MFA and Why Do You Need It?

MFA (Multi-Factor Authentication) means the user needs more than just a password to log in. They also need a second proof of identity, like:

• A code sent to their phone via text message
• A code from an authenticator app (like Microsoft Authenticator)
• A fingerprint or face scan (biometrics)
• A phone call that asks them to press a number

This is extremely important because passwords alone can be stolen. MFA makes it much harder for hackers to break in.

How to Enable MFA for a User

1. Go to Microsoft 365 Admin Center → Users → Active Users
2. Select the user
3. Under "Multi-factor authentication," click "Enable" or "Manage MFA"
4. The user will be prompted to set up MFA the next time they sign in

Resetting MFA for Users

If a user gets a new phone and can't access their authenticator app, you can reset their MFA from the admin center. This allows them to set it up again from scratch.

Temporary Access Pass

You can also issue a Temporary Access Pass – a one-time code that lets the user set up MFA without needing their old phone. This is especially useful for new employees.

↑ Back to Index

5. Windows Autopilot MS-900

What is Windows Autopilot?

Windows Autopilot is a technology that lets you set up new Windows computers without ever touching them. You order a computer from a vendor (like Dell or HP), ship it directly to the employee, and when they turn it on and connect to the internet, the computer automatically configures itself with your company's settings, apps, and security policies.

How Autopilot Works (Simple Version)

1. Vendor sends computer – Dell or HP ships the computer straight to the employee's home
2. Employee turns it on – They connect to Wi-Fi and see a standard Windows setup screen
3. They sign in with their work email – This is the key step! They use their Microsoft 365 email and password
4. Intune takes over – The computer is automatically enrolled in your company's management system
5. Apps and settings are installed – Microsoft 365, Chrome, antivirus, VPN settings, and everything else you configured get installed automatically
6. Computer is ready to use – In about 30–60 minutes (depending on internet speed), the employee has a fully configured work computer

Deployment Profiles

A deployment profile is a set of instructions that tells Autopilot how to set up the computer. You can create different profiles for different departments:

• User-driven – The employee signs in with their work email to start the setup
• Self-deploying – The computer sets itself up without anyone signing in (used for kiosks, shared devices, or conference room computers)
• Pre-provisioned – The IT department or vendor does most of the setup before shipping, so the employee has an even faster experience

Setting Up an Autopilot Profile

1. Go to Intune → Devices → Windows → Enrollment
2. Select Windows Autopilot → Deployment Profiles
3. Click "Create Profile" → name it (e.g., "New Employee Profile")
4. Choose User-driven mode
5. Select Microsoft Entra joined (cloud-only – no on-premise server needed)
6. Configure settings:
   • Hide privacy settings and license terms (so the user doesn't have to click through them)
   • Set user as Standard (not administrator) for regular employees
   • Choose which department/group this profile applies to
7. Click Create

Pre-Provisioning (Advanced)

If you want an even faster setup, you can create a pre-provisioning setup. This lets the vendor or IT staff do most of the heavy lifting before the user gets the computer. Steps include:

• Create an OEM (Original Equipment Manufacturer) access group so the vendor can log into your system
• Create a device preparation policy that specifies which apps and scripts should be pre-installed
• Upload a CSV file with the computer's manufacturer, model, and serial number so the system recognizes it as a company-owned device

↑ Back to Index

6. Microsoft Intune – Overview MS-900

What is Intune?

Microsoft Intune (pronounced "in-toon") is a cloud-based service that lets you manage all your company's devices from one place. Think of it as a remote control for your organization's computers, phones, and tablets.

With Intune, you can:

• ✅ Remotently install apps on computers
• ✅ Enforce security policies (like requiring a password or BitLocker encryption)
• ✅ Wipe a lost or stolen device completely
• ✅ Manage Windows, Mac, iOS (iPads/iPhones), Android, and even Linux devices
• ✅ Control Windows Updates across the whole company
• ✅ See which devices are healthy and which have problems

Intune vs. SCCM – What's the Difference?

SCCM (System Center Configuration Manager, now called Microsoft Endpoint Configuration Manager) is an older, on-premise tool that runs on a server in your office. Intune is the newer, cloud-based version that doesn't need any servers. Many companies use both together – this is called co-management.

↑ Back to Index

7. Device Enrollment & Management MS-900

How Does a Device Get "Enrolled"?

When a user signs into a Windows computer with their work email for the first time, the computer gets enrolled into Intune automatically (if you've set up Autopilot). This means Intune now "sees" the computer and can manage it.

After enrollment, you can see the device in the Intune console under Devices → Windows. It will show:

• Device name (e.g., DESKTOP-BVA0963)
• Primary user (who signed in first – e.g., Adele Vance)
• Last check-in time (when the device last communicated with Intune)
• Compliance status (whether it meets your security rules)
• OS version (e.g., Windows 11, version 23H2)

Device Platform Restrictions

You can create restrictions that control which devices are allowed to enroll. For example:

• Block personal devices – Only company-owned computers can be managed
• Block specific operating system versions – e.g., only allow Windows 10 or later
• Require minimum OS version – e.g., Windows 10 22H2 or newer

↑ Back to Index

8. Configuration Policies MS-900

What Are Configuration Policies?

Configuration policies are rules that tell a device how it should behave. Think of them as a "settings manager" – they enforce specific settings on all the computers you manage.

Types of Configuration Policies

• Settings Catalog – Start from scratch and pick individual settings from a huge library
• Templates – Pre-built groups of settings for common tasks like VPN, Wi-Fi, Email, or Endpoint Protection
• Custom – For advanced users who want to use specific settings not available in the catalog

Common Things You Can Configure

• Device Restrictions – Block app store, disable control panel, prevent installing apps on system drive
• VPN – Automatically configure VPN settings (Cisco AnyConnect, Pulse Secure, etc.)
• Wi-Fi – Push Wi-Fi network settings so users don't need to enter them manually
• Email – Configure email accounts automatically
• Endpoint Protection – Manage Windows Defender, firewall, encryption settings
• Device Firmware – Configure BIOS/UEFI settings

How to Create a Configuration Policy

1. Go to Intune → Devices → Windows → Configuration Profiles
2. Click "Create Profile" → choose platform (Windows 10 or later)
3. Select profile type (Settings catalog or Templates)
4. Configure the settings you want
5. Assign to a group (e.g., "All Windows Devices" or "Finance Department")
6. Click Create

↑ Back to Index

9. Compliance Policies MS-900

What is a Compliance Policy?

A compliance policy is a set of rules that checks whether a device is "healthy" and following your security requirements. If a device is non-compliant, you can take actions like:

• Sending an email notification to the user
• Blocking access to company resources (email, Teams, SharePoint)
• Marking the device as risky

Common Compliance Rules

• BitLocker required – Checks if the hard drive encryption is turned on
• Secure Boot required – Checks if the computer boots securely
• Minimum OS version – e.g., requires Windows 10 22H2 or newer
• Firewall enabled – Checks that Windows Firewall is on
• Antivirus enabled – Checks that Windows Defender (or another antivirus) is running and up to date
• Password required – Checks that the device has a password or PIN to unlock
• TPM (Trusted Platform Module) present – Checks for the security chip that handles encryption. Windows 11 requires TPM 2.0.

Creating a Compliance Policy

1. Go to Intune → Devices → Windows → Compliance Policies
2. Click "Create Policy"
3. Choose Windows 10 or later
4. Configure rules (Device Health, Device Properties, System Security, etc.)
5. Set actions for non-compliance (e.g., send email after 7 days of non-compliance)
6. Assign to groups and click Create

Notification Templates

You can create an email notification template that gets sent to users when their device is non-compliant. For example:

"Subject: Your computer needs attention
Body: Please turn on your computer and make sure it is connected to the internet so it can receive security updates."

↑ Back to Index

10. App Deployment via Intune MS-900

How to Install Apps Remotely

With Intune, you can push (install) applications to computers without visiting them. This works for the Microsoft 365 apps, third-party software like Google Chrome, and custom business applications.

Types of Apps You Can Deploy

• Microsoft 365 Apps – Word, Excel, PowerPoint, Outlook, Teams – pre-configured
• Windows Store Apps – Apps from the Microsoft Store
• Web Links – Shortcuts to websites that appear in the Start Menu
• Win32 Apps – Traditional Windows programs (.exe, .msi) that need special packaging
• Line of Business (LOB) Apps – Custom apps made for your company
• Built-in Apps – Microsoft Edge, etc.

Packaging a Win32 App (e.g., Google Chrome)

For traditional apps, you need to package them using the Intune Win32 App Packaging Tool (also called "IntuneWinAppUtil"). Here's the process:

1. Download the MSI or EXE installer for the app (e.g., Google Chrome MSI)
2. Use the IntuneWinAppUtil tool to convert it into a .intunewin file
3. In Intune, go to Apps → Windows → Add
4. Select Windows app (Win32)
5. Upload the .intunewin package file
6. Configure:
   • Name, Description, Publisher
   • Install command (e.g., msiexec /i "chrome.msi" /q for silent install)
   • Detection rules – How Intune knows the app is already installed (e.g., check registry key)
   • Requirements – 32-bit or 64-bit, minimum OS version
7. Assign to groups (users or devices)
8. Click Create

Web Links (Shortcuts)

You can also push web links as apps. For example, you can create a shortcut to your company's internal website or a SaaS tool. The user will see it in their Start Menu under "Apps."

↑ Back to Index

11. Update Rings (Windows Updates) MS-900

What Are Update Rings?

Update rings let you control how and when Windows Updates are installed on your company's computers. Instead of each computer getting updates whenever Microsoft releases them, you decide the schedule.

Why Use Multiple Rings?

Imagine a new Windows update comes out. It might have bugs that could break your software. With update rings, you can:

1. Ring 1 (IT/Testers) – Get the update immediately. IT staff test it first.
2. Ring 2 (All Users) – Get the update 7–10 days later, after IT confirms it's safe.
3. Ring 3 (Critical Systems) – Get the update last, after everyone else has confirmed it's working fine.

Settings You Can Configure

• Quality Updates – Monthly security fixes. You can defer them up to 30 days.
• Feature Updates – Major version upgrades (e.g., from Windows 10 to Windows 11). You can defer up to 365 days.
• Update Windows 10 to Windows 11 – Option to auto-upgrade compatible devices
• Maintenance Window – Set hours when updates are NOT allowed to install (e.g., 6 AM to 7 PM during work hours)
• Deadline Settings – Force the update to install by a certain date
• Pause Updates – Temporarily stop all updates if there's a known problem

How to Create an Update Ring

1. Go to Intune → Devices → Windows → Update Rings
2. Click "Create Profile"
3. Name it (e.g., "Ring 2 – Users")
4. Configure deferral periods and maintenance times
5. Assign to a group (e.g., "All Users" or "Finance Department")
6. Click Create

↑ Back to Index

12. Microsoft Endpoint Configuration Manager (MECM/SCCM) MS-900

What is SCCM/MECM?

Microsoft Endpoint Configuration Manager (MECM) – formerly called System Center Configuration Manager (SCCM) and sometimes referred to as "SECM" – is a server-based tool that manages computers on your company's network. It's the older, on-premise version of Intune.

How It Works (Simple Explanation)

Imagine you have 100 computers in your office. Instead of walking to each one to install software, you use Configuration Manager:

1. The Server – A powerful computer running Configuration Manager that holds all the software packages
2. Distribution Points – Other servers or computers that store copies of the software for faster access
3. Client Software – A small program installed on each computer that talks to the server
4. Software Center – The app on each computer where users can see and install available software

Server → Client Communication

• The server sends instructions: "Install Google Chrome on all Finance computers"
• The client on each Finance computer receives the instruction
• The client downloads the software from a distribution point and installs it
• The client reports back: "Installation complete"

↑ Back to Index

13. Software Center MS-900

What is Software Center?

Software Center is an app that comes with Configuration Manager. It's installed on every managed computer and lets users see and install software that the IT department has made available to them.

What You See in Software Center

• Applications – Software available for you to install (like Skype, Chrome, or Microsoft Office)
• Updates – Windows updates and other software updates that are pending
• Installation Status – Shows what's currently installing and what has been installed
• Device Compliance – Whether your computer follows company policies
• Options – Business hours, power management settings

How to Install Software from Software Center

1. Open Software Center from the Start Menu
2. Click the "Applications" tab
3. Find the software you want (e.g., 7-Zip, Google Chrome)
4. Click "Install"
5. The software downloads and installs automatically – you'll see a notification when it's done

↑ Back to Index

14. Packages vs. Applications MS-900

What's the Difference?

In Configuration Manager, there are two ways to deploy software: Packages and Applications. They can both install the same software, but they work differently:

Feature	Packages	Applications
Target	Computers / Devices	Users
Install type	Attended or Unattended	Always Unattended (silent)
Detection method	Basic (run once)	Advanced (detects if already installed)
Repair / Uninstall	Manual	Built-in options available
Best for	Servers, system tools, scripts	User-facing software (Office, Chrome)

How to Create an Application (Step by Step)

1. Open Configuration Manager Console → Software Library
2. Expand Application Management → Applications
3. Right-click → Create Application
4. Choose "Manually specify the application information" or "Automatically detect from installation files"
5. If using MSI, browse to the network path (UNC path like \\server\share\app.msi)
6. Configure:
   • Name (e.g., "Skype for Business")
   • Publisher (Microsoft)
   • Install command (auto-filled for MSI)
   • Install behavior – "Install for system" (all users) or "Install for user" (only the current user)
7. Click Next → confirm → Close

Deploying the Application

1. Right-click the application → Deploy
2. Choose a Collection (who gets it – e.g., "All Users")
3. Select a Distribution Point Group (where the software files will be stored for clients to download)
4. Set Purpose: Available (users can install if they want) or Required (forces installation)
5. Schedule the deployment (immediately or at a specific time)
6. Click Next → Close

↑ Back to Index

15. Distribution Points MS-900

What is a Distribution Point?

A Distribution Point (DP) is a server or computer that stores copies of software packages so client computers can download them. Instead of 100 computers all downloading from one server (which would be very slow), they download from the nearest distribution point.

Why Distribution Points Matter

• Speed – Clients download from a local DP instead of a distant server
• Bandwidth saving – The software is copied to DPs once, then clients download locally
• Reliability – If one DP is down, clients can use another one

How It Works

1. You create a software package on the main site server
2. The package is distributed (copied) to all distribution points in your network
3. When a client needs to install the software, it downloads from the nearest DP
4. The client runs the installation locally

↑ Back to Index

16. Client Installation & Client Center MS-900

What is the Configuration Manager Client?

For a computer to be managed by Configuration Manager, it needs the Configuration Manager client installed. This client software (located in C:\Windows\CCM) communicates with the server, receives instructions, and installs software.

Installing the Client – Method 1: Automatic (Push)

Normally, when a new computer joins your domain, Configuration Manager should automatically push (install) the client to it. This doesn't always work perfectly (especially with Windows 11), so sometimes you need to do it manually.

Installing the Client – Method 2: Manual

1. On the Configuration Manager server, find the client installer at:
   C:\Program Files\Microsoft Configuration Manager\Client\ccmsetup.exe
2. Copy the entire Client folder to the target computer (e.g., to C:\Client\)
3. On the target computer, run ccmsetup.exe as Administrator
4. The setup will install the client, which includes:
   • Software Center – For users to manage software
   • Configuration Manager – In Control Panel, for IT to manage advanced settings
5. Wait 5–30 minutes for the installation to complete

Client Actions (How to Refresh Policies)

Once the client is installed, you can find it in Control Panel → Configuration Manager. The Actions tab is very important – these actions let you refresh policies and check for new software:

• Application Deployment Evaluation Cycle – Checks for new applications
• Machine Policy Retrieval & Evaluation Cycle – Gets the latest policies from the server
• Software Inventory Cycle – Reports what software is installed
• Software Update Scan Cycle – Checks for new updates

Instead of waiting for the automatic cycle (which could take hours), you can manually run these actions by selecting them and clicking "Run Now."

Client Center for Configuration Manager (Third-Party Tool)

The presenter demonstrates a tool called Client Center for Configuration Manager. This is a free, open-source tool (not made by Microsoft) that lets IT support staff remotely:

• View and manage the client on remote computers
• Re-run advertisements / installations
• View software inventory
• Check pending updates
• Repair or reinstall the client agent
• Restart remote computers

↑ Back to Index

17. Managing Devices – Wipe, Retire, Remote Control MS-900

Device Actions in Intune

Once a device is enrolled in Intune, you can perform several powerful actions remotely:

Wipe

Wipe performs a factory reset. It erases everything on the computer and restores it to its original state. Use this when:

• An employee leaves the company and returns their computer
• A computer is going to be given to a different employee
• The computer has malware that can't be removed

Retire

Retire removes the device from Intune management. It removes company data and policies but keeps the user's personal files. This is mainly used for BYOD (Bring Your Own Device) scenarios where the employee owns the phone or computer.

Reset Password

You can remotely reset a user's password if they forgot it.

Revoke Sessions

If a user is having sign-in issues (e.g., they're locked out because an old session is still active on another device), you can revoke all sessions. This signs them out everywhere and forces them to sign in again with the new password.

Remote Control via Configuration Manager

Configuration Manager supports remote control – you can view and control a user's computer to help them troubleshoot. This is found under Client → right-click → Start → Remote Control.

↑ Back to Index

19. Microsoft 365 Apps Deep Dive MS-900

Microsoft 365 is more than just Word and Excel. It's a family of connected apps and services that work together. For the MS-900 exam, you need to understand what each major service does.

The Core Services

Service	What It Does	Common Name
Exchange Online	Professional email, calendar, and contacts. Every user gets a mailbox with advanced features.	Email / Outlook
SharePoint Online	A website system for sharing documents and building internal company sites (intranet). Teams use it to store and collaborate on files.	Team sites / Document libraries
OneDrive for Business	Personal cloud storage for each user. Like a private "cloud drive" where you can access your files from any device.	Cloud storage
Microsoft Teams	The hub for teamwork. Chat, video calls, meetings, file sharing, and app integration in one place. Replaced Skype for Business.	Chat / Video calls
Microsoft 365 Apps	The familiar Office apps: Word, Excel, PowerPoint, Outlook, Access (PC only), Publisher (PC only). Installed locally or used in a web browser.	Office apps
Viva	An employee experience platform. Includes Viva Connections (intranet feed), Viva Learning (training), Viva Insights (wellbeing/analytics), and Viva Topics (knowledge discovery).	Employee experience
Power Platform	Low-code tools: Power Apps (build apps), Power Automate (automate workflows), Power BI (data dashboards), Power Virtual Agents (chatbots).	Low-code / Automation
Yammer	An enterprise social network. Like a private Facebook for your company to share news and connect across departments.	Company social network

How They Connect

Here's a real-world example: A team uses Teams to chat and meet. Files shared in Teams are stored in SharePoint document libraries. Each person's private files are in their own OneDrive. When someone sends an invite to a Teams meeting, it shows up in Exchange Online (Outlook calendar). All of this is covered by the same compliance policies.

↑ Back to Index

20. Conditional Access & Identity Protection MS-900

What is Conditional Access?

Conditional Access is like a smart bouncer at a club. The bouncer checks different conditions before letting someone in: "Is the person on the guest list? Is it after hours? Are they dressed appropriately?" Similarly, Conditional Access checks conditions like:

• Location – Is the user signing in from the office? Or from a different country?
• Device – Is the device managed by your company? Is it compliant with policies?
• Risk level – Is this login attempt suspicious? (detected by Identity Protection)
• Application – Which app are they trying to access? (Sensitive apps can have stricter rules)
• User group – Is the user in the "Finance" or "Executive" group?

Conditional Access Policies – Simple Examples

• "If a user is not in the office, require MFA."
• "If accessing the HR system from an unknown device, block access."
• "If login appears risky (unusual travel, new device), require password change."

Identity Protection (Risk Detection)

Microsoft Entra ID Protection automatically detects risky sign-in behavior, such as:

• Leaked credentials – A username/password was found on the dark web
• Anonymous IP address – The login came from a VPN or Tor network
• Atypical travel – A login from New York, then 10 minutes later from London (impossible unless someone else has the password)
• Malware-linked IP – The connection came from an IP address known to be infected
• Unfamiliar sign-in properties – New device, new browser, new location

When a risk is detected, you can configure automated responses like: require MFA, require password change, or block sign-in entirely.

Identity Governance

Identity Governance makes sure the right people have the right access to the right resources. Key features:

• Access Reviews – Managers regularly review who has access to what, and remove old permissions
• Entitlement Management – Automate access requests and approvals for apps and groups
• Privileged Identity Management (PIM) – Give temporary admin access that expires automatically (just-in-time access)

↑ Back to Index

21. Microsoft Purview Compliance MS-900

What is Compliance in Microsoft 365?

Companies often have legal and regulatory requirements about how data must be handled. For example, banks must keep customer records for 7 years, and hospitals must protect patient information (HIPAA). Microsoft Purview provides the tools to meet these requirements.

Key Purview Features

Feature	What It Does
Data Loss Prevention (DLP)	Prevents sensitive information (credit card numbers, Social Security numbers, medical records) from being accidentally shared via email or Teams. If someone tries to email a credit card number, DLP can block the email or warn the user.
Retention Policies	Controls how long data is kept and when it's deleted. For example: "Keep all emails for 7 years, then automatically delete them."
eDiscovery	Allows legal teams to search for specific data across the entire organization (emails, documents, chats) when preparing for a lawsuit or audit.
Audit Logs	Records who did what and when. "Who deleted the contract file?" "Who changed the document permissions?"
Communication Compliance	Detects and reviews inappropriate messages (harassment, offensive language, sharing confidential information) in emails and Teams chats.
Sensitivity Labels	Tags you can apply to documents and emails: "Confidential", "Internal", "Public". Once labeled, the data is automatically protected (encrypted, restricted).
Records Management	Marks certain documents as "records" that cannot be modified or deleted for legal purposes.

↑ Back to Index

23. Subscriptions, Billing & Licensing MS-900

How Microsoft 365 Subscriptions Work

Microsoft 365 is a subscription-based service. You pay a monthly or annual fee per user. This is called a per-user subscription model.

Subscription Types

• Business plans – For companies with up to 300 users:
  • Microsoft 365 Business Basic ($6/user/month) – Web & mobile apps only
  • Microsoft 365 Business Standard ($12.50/user/month) – Desktop Office apps included
  • Microsoft 365 Business Premium ($22/user/month) – Includes Intune, advanced security
• Enterprise plans – For larger organizations (no user limit):
  • Microsoft 365 E3 ($36/user/month) – Full security and compliance features
  • Microsoft 365 E5 ($57/user/month) – Advanced security, analytics, voice features
  • Office 365 E1/E3/E5 – Email, Teams, and Office apps only (no Windows or device management)
• Frontline plans – For shift workers and deskless employees:
  • Microsoft 365 F1 ($10/user/month)
  • Microsoft 365 F3 ($20/user/month) – Similar to Business Basic but with different terms
• Standalone plans – Individual services you can buy separately:
  • Exchange Online Plan 1 ($4/user/month) – Email only
  • SharePoint Plan 1 ($5/user/month)
  • Microsoft Intune ($8/user/month)

Billing & Payment Options

• Monthly billing – You pay at the beginning of each month based on the number of licensed users
• Annual billing – You commit to a 12-month term and can pay monthly or upfront. Annual billing is cheaper per user.
• Cancellation – You can cancel at any time. Microsoft will refund unused time (prorated).
• Billing frequency – Monthly, quarterly, or annual invoices are available

Managing Licenses

• License assignment – Each user needs their own license assigned to their account
• Unlicensed users – You can create user accounts without licenses. They just can't use Microsoft 365 services
• Reclaiming licenses – When a user leaves, remove their license so you can assign it to someone else
• License pools – You buy a number of licenses (e.g., 50 Standard licenses) and assign them to users as needed
• Self-service purchase – In some plans, users can buy their own licenses (feature can be turned off by admins)

↑ Back to Index

32. Intune Implementation Guide – Complete Step-by-Step MS-900

This section provides a complete, end-to-end Intune implementation guide based on Microsoft's official documentation and real-world deployment practices. Use this as your checklist for rolling out Intune in your organization.

Prerequisites

Before you begin, ensure you have:

• Microsoft 365 subscription with EMS (Enterprise Mobility + Security) E3/E5 or Microsoft 365 E3/E5
• Global Admin or Intune Admin permissions in Microsoft Entra ID
• DNS verification of your domain (if using custom domain)
• Licenses assigned to users who will enroll devices

Phase 1: Initial Setup & Configuration

Step 1: Set Up Intune in Microsoft Endpoint Manager

1. Go to endpoint.microsoft.com
2. If first-time setup, you'll see a guided setup wizard
3. Verify your MDM authority is set to Microsoft Intune
4. Navigate to: Tenant administration → MDM authority
5. Set to Microsoft Intune

Step 2: Configure MDM Authority (Critical)

1. Navigate to: Microsoft Entra ID → Mobility (MDM and MAM) → Microsoft Intune
2. Configure MDM user scope – Choose one:
   • None – No one auto-enrolls (manual only)
   • Some – Select specific security groups
   • All – All users auto-enroll (recommended for full deployment)
3. Set MAM user scope similarly (for app protection without enrollment)
4. Click Save

Step 3: Configure Enrollment Restrictions

1. Endpoint Manager → Devices → Enrollment → Enrollment restrictions
2. Set Device platform restrictions (allow/block iOS, Android, Windows, macOS)
3. Set Device limit restrictions (how many devices per user – default is 15)
4. Configure Block for personally owned devices if you want company-owned only

Step 4: Configure Platform-Specific Enrollment

For Windows 10/11 Devices:

• Endpoint Manager → Devices → Windows → Windows enrollment
• Choose enrollment method:
  • Auto-enrollment via MDM (via GPO/Group Policy or Azure AD Join)
  • Autopilot (for zero-touch deployment) – requires Windows 10/11 Pro, Enterprise, or Education
  • Manual enrollment (Settings → Accounts → Access work or school)
• Enable MDM Discovery URL in DNS for automatic enrollment

For iOS/iPadOS:

• Upload Apple MDM Push Certificate (requires Apple ID)
  • Endpoint Manager → Devices → iOS/iPadOS → iOS enrollment → Apple MDM Push Certificate
  • Download the CSR → Upload to Apple Push Certificates Portal → Download the cert → Upload back
• Configure enrollment profile (user affinity vs. device enrollment)

For Android:

• Work Profile (recommended for BYOD): Endpoint Manager → Devices → Android → Android enrollment
• Android Enterprise (fully managed): For company-owned devices
• Android (device administrator): Legacy method, less secure
• Follow the wizard to bind your Google account

For macOS:

• Upload Apple MDM Push Certificate (same as iOS)
• Configure enrollment profile
• Use Company Portal app for enrollment

Step 5: Create Compliance Policies

1. Endpoint Manager → Devices → Compliance policies → Create Policy
2. Set requirements like:
   • OS version minimum
   • Password/PIN requirements (length, complexity)
   • Encryption requirements
   • Jailbreak/root detection
   • Threat level (if using Microsoft Defender)
3. Assign to security groups (e.g., "All Devices" or specific groups)

Step 6: Create Configuration Profiles

1. Endpoint Manager → Devices → Configuration profiles → Create profile
2. Platform: Windows 10/11, iOS, Android, macOS
3. Profile types include:
   • Device restrictions (block camera, app store, etc.)
   • Email (set up Exchange/O365 email profiles)
   • Wi-Fi (deploy Wi-Fi settings)
   • VPN (auto-configure VPN)
   • Certificate (deploy SCEP/PFX certificates)
4. Assign to groups and deploy

Step 7: Set Up App Protection Policies (MAM)

1. Endpoint Manager → Apps → App protection policies → Create policy
2. For iOS/Android: Select apps (Outlook, Teams, OneDrive, etc.)
3. Configure:
   • Data protection: Prevent copy/paste between work/personal apps
   • Access requirements: PIN/biometric to open work apps
   • Conditional launch: Jailbreak check, max PIN attempts
4. Assign to user groups

Phase 2: Device Registration (Enrollment)

For Windows Devices

1. Azure AD Join (Recommended):
   • User goes to Settings → Accounts → Access work or school
   • Clicks Connect → Enters work email → Signs in → Device enrolls automatically
   • Or via Windows Autopilot: Device boots → OOBE → Auto-enrolls with company branding
2. Manual Enrollment:
   • Download Company Portal from Microsoft Store
   • Sign in with work credentials
   • Follow enrollment prompts

For iOS Devices

1. Install Microsoft Intune Company Portal from App Store
2. Open app → Sign in with work account
3. Accept permissions (device management profile)
4. Follow prompts to install management profile in Settings

For Android Devices

1. Install Microsoft Intune Company Portal from Google Play Store
2. Open app → Sign in with work account
3. Set up Work Profile (for BYOD) or fully managed (company-owned)
4. Accept management permissions

For macOS Devices

1. Install Company Portal from App Store
2. Sign in → Follow enrollment prompts
3. Management profile installs in System Preferences

Phase 3: Verify & Monitor

1. Endpoint Manager → Devices → All devices
   • Verify enrolled devices appear
   • Check compliance status (Compliant / Non-compliant)
2. Endpoint Manager → Devices → Monitor
   • Check enrollment failures
   • Review compliance reports
   • Generate device status reports
3. Conditional Access (Microsoft Entra ID):
   • Create policies that block access for non-compliant devices
   • Navigate: Microsoft Entra ID → Security → Conditional Access → Create policy
   • Assign to users → Cloud apps (Office 365) → Conditions (Device compliance) → Grant (Require compliant device)

Deep Dive: Windows Autopilot (Zero-Touch Deployment)

What is Autopilot?

A fully automated deployment process where a brand-new Windows device, straight from the box, joins Azure AD, enrolls in Intune, applies policies, and installs apps without IT touching it.

Requirements

• Windows 10/11 Pro, Enterprise, or Education (not Home)
• Microsoft 365 E3/E5 or EMS E3/E5 licenses
• Intune configured as MDM authority
• Device registered in Windows Autopilot service

Register Devices in Autopilot

Method A: OEM/Reseller Registration (Recommended)

1. Purchase from Microsoft partner who supports Autopilot
2. Partner uploads device hardware hash to Microsoft
3. Devices automatically appear in Endpoint Manager → Devices → Windows → Windows enrollment → Devices

Method B: Manual Registration with PowerShell

# Install required module
Install-Module -Name WindowsAutopilotIntune -Force -Scope CurrentUser

# Import module
Import-Module WindowsAutopilotIntune

# Connect to Intune
Connect-MSGraph

# Get hardware hash from a running Windows device
# On the device (elevated PowerShell):
Get-WindowsAutoPilotInfo -OutputFile C:\AutopilotDevices.csv

# Upload to Intune (on admin machine):
Import-AutopilotCSV -CsvFile C:\AutopilotDevices.csv

Method C: Using a USB Stick (for existing devices)

# On each existing Windows 10/11 device (elevated PowerShell):
Install-Module -Name WindowsAutopilotIntune -Force
Set-ExecutionPolicy RemoteSigned
Get-WindowsAutoPilotInfo -OutputFile D:\DeviceHash-$(Get-Date -Format "yyyyMMdd-HHmmss").csv
# Move USB to admin machine and upload via Endpoint Manager

Configure Autopilot Deployment Profile

1. Endpoint Manager → Devices → Windows → Windows enrollment → Deployment Profiles
2. Create Profile → Windows Autopilot deployment profile

Setting	Recommended Value	Notes
Deployment mode	User-Driven or Self-Deploying	User-Driven: user signs in; Self-Deploying: no user needed (kiosks/shared devices)
Join to Azure AD as	Azure AD Joined or Hybrid Azure AD Joined	Azure AD Joined for cloud-only; Hybrid for on-prem AD sync
Microsoft Software License Terms	Hide	Skips EULA
Privacy settings	Hide	Skips Cortana/Diag settings
Hide change account options	Yes	Prevents user from changing login
User account type	Standard (recommended) or Administrator	Standard = user is local user, not admin
Allow pre-provisioned deployment	Yes	White Glove: IT pre-configures, user finalizes
Language	Operating system default	Or set to specific locale
Keyboard	Same as language

Configure Enrollment Status Page (ESP)

• Endpoint Manager → Devices → Windows → Windows enrollment → Enrollment Status Page
• Create Profile → Configure:
  • Show app and profile installation progress: Yes
  • Block device use until all apps and profiles are installed: Yes (Recommended)
  • Allow users to reset device if installation error occurs: Yes
  • Installation timeout (minutes): 60
  • Show error when installation takes longer than specified minutes: Yes

White Glove (Pre-Provisioning) Deployments

For IT to pre-configure devices before handing to users:

1. Boot device → At OOBE, press Ctrl+Shift+D five times (Win10) or press Windows key 5 times (Win11)
2. IT tech signs in → Device provisions apps/policies
3. Tech hits Reseal → Device shuts down
4. User powers on → Enters work credentials → Completes in ~2 minutes

Deep Dive: Conditional Access

What is Conditional Access?

A Microsoft Entra ID feature that enforces security policies before granting access to resources. It checks conditions (device compliance, location, risk) and grants/denies/blocks access.

Requirements

• Microsoft Entra ID P1 or P2 license (included in E3/E5)
• Intune configured with compliance policies
• Devices enrolled and reporting compliance status

Common Conditional Access Policies

Policy 1: Require Compliant Device for Office 365

Name: "CA-001: Require Compliant Device for O365"

• Assignments:
  • Users: All users (exclude emergency break-glass accounts)
  • Cloud apps: Office 365 (or specific apps: Exchange, SharePoint, Teams)
  • Conditions: Device platforms: All, Locations: Any, Client apps: Browser, Mobile apps, Desktop clients
• Access controls – Grant:
  • Require device to be marked as compliant: YES
  • Require Hybrid Azure AD joined device: NO
  • Require approved client app: NO
  • Require app protection policy: NO
  • For multiple controls: Require ALL
• Enable policy: ON (Report-only first!)

Policy 2: Block Legacy Authentication (Highly Important)

Name: "CA-002: Block Legacy Authentication"

• Assignments:
  • Users: All users (exclude break-glass accounts)
  • Cloud apps: All cloud apps
  • Conditions – Client apps: Mobile apps and desktop clients: ANY, Exchange ActiveSync clients: ANY, Other clients: ANY
• Access controls – Grant: Block access: YES
• Enable policy: ON

Policy 3: MFA for Risky Sign-ins (Requires P2)

Name: "CA-003: MFA for Medium+ Risk Users"

• Assignments:
  • Users: All users
  • Cloud apps: All cloud apps
  • Conditions: Sign-in risk: Medium and above, User risk: Medium and above
• Access controls – Grant:
  • Require multi-factor authentication: YES
  • Require password change: YES (for compromised user)
• Enable policy: ON

How to Create Conditional Access Policies

1. Go to Microsoft Entra admin center → Protection → Conditional Access → Policies
2. Click + New policy → Create new policy
3. Name: Use consistent naming convention (e.g., CA-###: Description)
4. Assignments tab:
   • Users: Include/Exclude (ALWAYS exclude at least 2 emergency break-glass admin accounts)
   • Cloud apps: Select the applications
   • Conditions: Device platforms, locations, client apps, sign-in risk
5. Access controls tab:
   • Grant: Block, Require MFA, Require compliant device, Require hybrid join, etc.
   • Session: Sign-in frequency, persistent browser session, app enforced restrictions
6. Enable policy → Report-only for at least 1 week before switching to On
7. Use What If tool to test policy against a specific user, location, or device

Deep Dive: Troubleshooting Enrollment Issues

Common Issues & Solutions

Issue A: Device Not Enrolling (Windows)

Symptom	Cause	Solution
"Cannot connect to work"	MDM discovery URL not configured	Add CNAME record in DNS
"Access denied"	User lacks license	Assign Intune/EMS license
"Policy did not apply"	Device not in correct group	Check device group membership
"Enrollment blocked"	Enrollment restriction blocking platform	Check Endpoint Manager → Devices → Enrollment restrictions
"Autopilot not triggering"	Device not registered in Autopilot	Check Endpoint Manager → Devices → Autopilot devices

Diagnostic Command (run on Windows device):

# Check MDM enrollment status
dsregcmd /status
# Look for:
#   AzureAdJoined: YES
#   DomainJoined: NO
#   DeviceId: {GUID}

Issue B: Company Portal App Issues

Problem	Fix
iOS/Android app crashes	Uninstall/reinstall Company Portal
Windows Company Portal not detecting enrollment	Run dsregcmd /leave then dsregcmd /join
macOS enrollment not completing	Remove MDM profile in System Preferences → Profiles → Re-enroll
"We couldn't connect"	Check firewall/proxy allows *.manage.microsoft.com

Issue C: Compliance Issues

Symptom	Cause	Solution
Device marked Non-compliant	OS version too old	Update Windows/iOS/Android
Device marked Non-compliant	Encryption not enabled	Enable BitLocker (Windows) or FileVault (macOS)
Device marked Non-compliant	No password/PIN set	Set device passcode
"Device not evaluated"	No compliance policy assigned	Assign compliance policy to device group

Force Re-check Compliance:

# Windows: Settings → Accounts → Access work or school → Click device → Sync
# iOS/Android: Open Company Portal → Check Access

# Instant sync from admin (PowerShell):
Connect-MSGraph
Invoke-IntuneDeviceCompliance -DeviceId "device-id" -Action sync

Issue D: Apple MDM Push Certificate Issues

Problem	Cause	Fix
Certificate expired	Renewal needed	Renew via Endpoint Manager → iOS/iPadOS enrollment → Apple MDM Push Certificate → Renew
"Certificate not trusted"	Certificate not re-uploaded	Download CSR → Upload to Apple Push Certificates Portal → Download new → Upload to Intune
Devices not appearing	APNs not connected	Check cert expiry date, re-upload

Renewal process (must be done annually):

1. Endpoint Manager → Devices → iOS/iPadOS enrollment → Apple MDM Push Certificate
2. Click Renew → Download CSR file
3. Go to Apple Push Certificates Portal → Sign in with Apple ID → Renew certificate
4. Download the renewed certificate → Upload to Intune → Save

Issue E: DNS/Network Issues

Configure these firewall/proxy allowlist entries:

# Required URLs for enrollment
*.manage.microsoft.com
*.manage.manage.microsoft.com
*.portal.manage.microsoft.com
*.registration.microsoft.com
*.cdn-registration.microsoft.com
login.microsoftonline.com
*.login.microsoft.com
*.graph.microsoft.com
*.device.microsoft.com

# Windows Update
*.update.microsoft.com
*.windowsupdate.com
ctldl.windowsupdate.com

# For Autopilot (self-deploying mode)
*.registration.microsoft.com

Check DNS MDM Discovery:

# From a Windows device, verify the CNAME record
Resolve-DnsName enterpriseenrollment.yourdomain.com
# Should resolve to: enterpriseenrollment.manage.microsoft.com

Apple Business Manager (for Corporate Devices)

What is Apple Business Manager (ABM)?

Apple's portal for managing corporate-owned Apple devices (iPhone, iPad, Mac) purchased from Apple or authorized resellers. Enables Automated Device Enrollment (ADE, formerly DEP).

Setup Steps

1. Enroll in ABM at business.apple.com
2. Verify domain → Apple sends verification to your domain registrar
3. Link to MDM (Intune):
   • Endpoint Manager → Devices → iOS/iPadOS enrollment → Enrollment Program Tokens
   • Click Add → Follow wizard to download public key
   • Upload public key to ABM → ABM provides a token → Upload token to Intune
4. Configure enrollment profile in Intune:
   • Endpoint Manager → Devices → iOS/iPadOS enrollment → Enrollment Program Profiles
   • Create Profile → Select Setup Assistant options (skip what you want)
   • Supervise devices: Yes (gives full control)
   • Lock device to MDM: Yes (prevents unenrollment)
   • Assign devices from ABM to this profile
5. Purchase devices from Apple or authorized reseller with your ABM number (Reseller ID/DEP ID)
6. End-user experience: Device powers on → OOBE shows company branding → Auto-enrolls → User signs in → Ready

Feature	Manual (Company Portal)	ABM (Automated Device Enrollment)
User action required	Install app, sign in	Just sign in during OOBE
Supervision	No	Yes (full management)
Can user remove management?	Yes	No (if locked)
Pre-configuration	No	Yes (skip setup screens)

Android Zero-Touch Enrollment

What is Android Zero-Touch?

Google's equivalent of Autopilot/ABM for corporate Android devices. Devices are automatically enrolled and configured when turned on for the first time.

Setup Steps

1. Enroll at zero-touch.google.com with a Google account that has domain admin access
2. Sign up → Verify domain through DNS TXT record
3. Configure enrollment:
   • Disable Google account personal setup
   • Set Wi-Fi credentials (optional but recommended)
   • Choose Work Profile (BYOD) or Fully Managed (corporate device)
   • Set Intune as the EMM (Enterprise Mobility Management)
4. Add reseller: Connect with authorized Android reseller, provide your Zero-Touch customer ID
5. Link to Intune:
   • Endpoint Manager → Devices → Android → Android enrollment → Managed Google Play
   • Follow wizard to bind organization
   • Enable Android Zero-Touch enrollment
6. End-user experience: Device powers on → Zero-Touch detects corporate ownership → Auto-enrolls into Intune → User signs in → Ready

Aspect	Work Profile (BYOD)	Fully Managed
Personal data	Separate container	No personal data allowed
Company data	Encrypted work profile	Full device encryption
IT visibility	Only work apps/data	Full device control
Best for	Employee-owned phones	Company-owned phones

DNS Configuration for MDM (Automatic Windows Enrollment)

Why Configure DNS?

When a user signs in to a Windows device with a work email (user@contoso.com), Windows needs to find the MDM server. Without DNS records, the user must manually enter the server URL.

DNS Records Needed

Record Type	Name	Value	TTL
CNAME	enterpriseenrollment.contoso.com	enterpriseenrollment-s.manage.microsoft.com	1 hour
CNAME	enterpriseregistration.contoso.com	enterpriseregistration.windows.net	1 hour

Setup in Your DNS Provider

# Record 1: MDM Discovery
Type: CNAME
Name/Host: enterpriseenrollment
Target: enterpriseenrollment-s.manage.microsoft.com
TTL: 3600 (1 hour)

# Record 2: Azure AD Registration
Type: CNAME
Name/Host: enterpriseregistration
Target: enterpriseregistration.windows.net
TTL: 3600 (1 hour)

Verify with PowerShell or nslookup:

nslookup enterpriseenrollment.contoso.com
# Should show: enterpriseenrollment-s.manage.microsoft.com

nslookup enterpriseregistration.contoso.com
# Should show: enterpriseregistration.windows.net

If Using Hybrid Azure AD Join (with On-Prem AD)

You also need:

• Azure AD Connect configured and syncing
• GPO configured for automatic MDM enrollment:
  1. Group Policy Management Console → Create new GPO
  2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → MDM
  3. Enable "Automatically enroll in MDM using Azure AD credentials"
  4. Set MDM URL: https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc
  5. Link GPO to the OU containing Windows devices

Licensing Deep Dive

How to License Users

1. Microsoft 365 Admin Center → Users → Active users
2. Select user → Licenses and apps
3. Assign one of:
   • Microsoft 365 E3 (includes Intune + Entra ID P1)
   • Microsoft 365 E5 (includes Intune + Entra ID P2 + Defender)
   • Enterprise Mobility + Security E3/E5 (add-on for existing M365 licenses)

Minimum License Required

• Per user: Each user who enrolls a device needs an Intune license
• Per device: Intune licenses are primarily user-based, but device licenses exist for self-deploying Autopilot, DEP without user affinity, and Android dedicated devices
• Type: Microsoft 365 E3, E5, F1/F3, EMS E3/E5, or standalone Intune

Bulk License Assignment (PowerShell)

# Install Microsoft Graph module
Install-Module Microsoft.Graph -Force

# Connect
Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"

# Get license SKU
$skus = Get-MgSubscribedSku
$intuneSku = $skus | Where-Object {$_.SkuPartNumber -eq "EMS" -or $_.SkuPartNumber -eq "DEVELOPERPACK_E5"} | Select-Object -First 1

# Assign to all users in a group
$users = Get-MgGroupMember -GroupId "group-id" -All
foreach ($user in $users) {
    Set-MgUserLicense -UserId $user.Id -AddLicenses @{SkuId = $intuneSku.SkuId} -RemoveLicenses @()
}

Recommended Rollout Strategy

Phase	Scope	Duration	Activities
1. Lab/Test	IT team only	1-2 weeks	Test all policies, profiles, enrollment methods
2. Pilot	Small pilot group (10-50 users)	2-4 weeks	Get feedback, refine policies
3. Staged Rollout	Department by department	4-8 weeks	Roll out with communication & training
4. Full Deployment	All users	Ongoing	Monitor, support, optimize

Sample Implementation Timeline

Week	Activities	Deliverables
1	Create M365 tenant, assign licenses, upload Apple/Google certs	Tenant configured
2	Create compliance policies, configuration profiles, enrollment restrictions	Core policies ready
3	Configure Autopilot (register 5 devices), test enrollment flows	Pilot working
4	Deploy Company Portal to 10 test users, monitor compliance	Pilot verified
5	Configure Conditional Access report-only, review sign-in logs	CA validated
6	Enable CA policies, expand to 50 users	Policies enforced
7-8	Roll out to all users, create self-help documentation	Full deployment

Quick Checklist

• Licenses assigned to users
• MDM authority set to Intune
• User scope configured (Some/All)
• Apple MDM Push Certificate uploaded (if using Apple devices)
• Android Enterprise binding configured (if using Android)
• Enrollment restrictions configured
• Compliance policies created and assigned
• Configuration profiles created (Email, Wi-Fi, VPN, etc.)
• App Protection Policies configured (MAM)
• Conditional Access policies configured
• Pilot group enrolled and verified
• End-user communication prepared (Company Portal installation guide)

Important Considerations

• BYOD vs. Corporate-Owned: Use different enrollment methods and policies for each
• Windows Autopilot: Highly recommended for corporate Windows devices (zero-touch deployment)
• Apple Business Manager: Use for corporate iOS/macOS devices to enable device enrollment
• Android Zero-Touch: Use for corporate Android devices
• Licensing: Every user needs an Intune license assigned in Microsoft 365 Admin Center
• DNS Configuration: Add MDM discovery records (CNAME) for automatic Windows enrollment

Recommended First Actions (Next Steps)

1. Right now: Verify you have the right licenses (M365 E3/E5 or EMS)
2. Today: Log into endpoint.microsoft.com and ensure MDM authority is Intune
3. This week: Assign licenses to a pilot group of 5-10 users
4. Next week: Enroll ONE test device manually via Company Portal to verify enrollment works
5. After that: Gradually implement the phased rollout plan

↑ Back to Index

33. Shared Mailboxes – Multi-User Email Access MS-900

What is a Shared Mailbox?

A shared mailbox is a mailbox that multiple users can use to read and send email messages, without needing their own separate login. It has no username/password of its own – users access it through their own mailbox. Shared mailboxes can also provide a common calendar for scheduling (e.g., vacation tracking or shift scheduling).

When to Use a Shared Mailbox

• Department email – info@company.com, sales@company.com, support@company.com
• Reception desk – Multiple receptionists monitoring one inbox
• HR inquiries – Shared HR mailbox for employee questions
• Project collaboration – Team members share a project-specific inbox

Types of Permissions

Permission	What It Allows	Example
Full Access	Log into the shared mailbox, read/view/delete emails, create calendar items, tasks, contacts. Does NOT allow sending email from the mailbox.	John can read all emails in support@company.com
Send As	Send email that appears to come from the shared mailbox itself. Recipients see "Support Department" as the sender.	Kweku sends an email that looks like it came from support@company.com
Send on Behalf	Send email that shows "John on behalf of Support Department." Recipients know a person sent it for the group.	Email shows "John on behalf of Support Department"

Creating a Shared Mailbox in Microsoft 365 Admin Center

1. Go to admin.microsoft.com → Teams & groups → Shared mailboxes
2. Click + Add a shared mailbox
3. Enter:
   • Name – e.g., "Support Department"
   • Email address – e.g., support@company.com
4. Click Add
5. After creation, click the mailbox → Edit → Add users to grant permissions
6. Select the users who need access
7. Choose permission level: Full Access and/or Send As
8. Click Save changes

Creating a Shared Mailbox via Exchange Online PowerShell

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline

# Create a shared mailbox
New-Mailbox -Shared -Name "Support Department" -DisplayName "Support Department" -Alias support

# Grant Full Access to a security group
Add-MailboxPermission -Identity "support@company.com" -User "SupportTeam@company.com" -AccessRights FullAccess -InheritanceType All

# Grant Send As permission
Add-RecipientPermission -Identity "support@company.com" -Trustee "SupportTeam@company.com" -AccessRights SendAs

# Grant Send on Behalf (PowerShell only)
Set-Mailbox -Identity "support@company.com" -GrantSendOnBehalfTo "SupportTeam@company.com"

# Disconnect
Disconnect-ExchangeOnline

How Users Access a Shared Mailbox

In Outlook (Windows):

1. File → Account Settings → Account Settings
2. Select your email → Change → More Settings
3. Advanced tab → Add under "Open these additional mailboxes"
4. Enter the shared mailbox email address → OK

In Outlook on the web (OWA):

1. Right-click on Folders in the left pane → Add shared folder
2. Enter the shared mailbox email → Add

Microsoft 365 Groups vs. Shared Mailboxes: Microsoft 365 Groups (formerly Office 365 Groups) also provide a shared inbox, calendar, and a SharePoint document library. If you need document collaboration in addition to email, use a Microsoft 365 Group instead. If you only need a shared email inbox, use a shared mailbox.

Shared Mailbox Limitations

• Storage: Shared mailboxes have a 50 GB storage limit in Microsoft 365 (no license required up to 50 GB). For larger storage, assign an Exchange Online Plan 2 or Exchange Online Kiosk license.
• License: A shared mailbox up to 50 GB does NOT require a license. If it exceeds 50 GB or you enable archive/retention policies, you must assign a license.
• Size limit: Maximum message size is 25-35 MB (same as regular mailboxes).
• Sign-in: Users cannot sign in directly to a shared mailbox. The associated account must remain disabled.

↑ Back to Index

34. Managing Intune for Remote Offices (Global Deployment) MS-900

Challenge: Remote Offices in Philippines & Greece

Managing devices across geographically dispersed offices (e.g., Manila, Philippines and Athens, Greece) introduces unique challenges: different time zones, local ISPs with varying speeds, language barriers, local regulations, and no on-site IT staff. Intune's cloud-native architecture is ideally suited for this scenario because it manages devices entirely over the internet.

Key Considerations for Remote / International Offices

1. Network Requirements

Intune communicates over HTTPS (port 443) to Microsoft's cloud services. Ensure the local firewall/proxy in each office allows these endpoints:

# Required Intune endpoints – allow through local firewalls
*.manage.microsoft.com
*.manage.manage.microsoft.com
*.portal.manage.microsoft.com
*.registration.microsoft.com
login.microsoftonline.com
*.login.microsoft.com
*.graph.microsoft.com
*.device.microsoft.com
*.autopilotsvc.com
enterpriseenrollment-s.manage.microsoft.com
enterpriseregistration.windows.net

Bandwidth recommendations:

• Minimum: 1 Mbps per device (for policy sync and app updates)
• Recommended: 5+ Mbps per office for 10-20 devices
• Intune is not bandwidth-hungry – it only syncs policy changes and app updates, not continuously streaming data

2. Device Enrollment for Remote Users

For remote offices where users may not have IT support on-site:

• Windows Autopilot – Ship devices directly to the employee in the Philippines or Greece. They power on, connect to internet, and the device auto-enrolls – zero IT touch required.
• Company Portal – For existing devices, users install Company Portal from the Microsoft Store (Windows), App Store (iOS), or Google Play (Android) and sign in with their work account.
• VPN not required – Devices manage directly over the internet; no VPN back to headquarters needed for management.

3. Local Language & Time Zone Settings

• Autopilot profiles: Set language and keyboard to match the local region (e.g., English for Philippines, Greek for Greece)
• Update rings: Configure maintenance windows based on local working hours (e.g., 8 PM – 6 AM local time)
• Compliance policies: You can create region-specific policies by assigning them to device groups organized by country/office

4. Organizing Devices by Location

Use device categories or dynamic device groups to organize devices by location:

# In Endpoint Manager:
# Devices → Enrollment → Device categories
# Create categories: "Manila_Office", "Athens_Office", "Remote_Worker"

# Then create dynamic device groups in Microsoft Entra ID:
# Groups → New group → Dynamic device
# Rule: (device.deviceCategory -eq "Manila_Office")
# Assign different policies, compliance rules, and app deployments per group

5. Reporting & Monitoring

• Endpoint Manager → Devices → Monitor → Enrollment failures – see which remote devices failed enrollment
• Compliance reports – check compliance status per location
• Device actions – remotely sync, wipe, restart, or retire devices in any country

6. Local Regulations & Data Residency

• Philippines: Data Privacy Act (Republic Act 10173). Microsoft 365 data can be stored in Asia-Pacific datacenters (Singapore, Japan, or Australia). Intune management data is handled in the region you select during tenant setup.
• Greece/EU: GDPR compliance. Microsoft 365 offers EU Data Boundary. Select European datacenters (Ireland, Netherlands, Austria) during tenant creation to ensure data stays within EU.
• Microsoft Data Residency: Choose your tenant's data location during initial setup. Data at rest for Intune is stored in the region closest to your tenant's primary location.

7. Delegated Admin for Local IT

If you have local IT staff in the Philippines or Greece, give them limited admin access without granting global admin rights:

# In Microsoft Entra ID → Roles and administrators
# Assign "Intune Administrator" role to local IT staff
# This allows them to manage devices, policies, and apps
# WITHOUT access to billing, user management, or global settings

# For even more limited access, create a custom role:
# Endpoint Manager → Tenant administration → Roles → Custom role
# Select only the permissions needed (e.g., read-only, app deployment, etc.)

Quick Checklist for Remote Office Setup

• Verify local internet meets minimum bandwidth (1 Mbps per device)
• Configure firewall to allow Intune URLs
• Create device categories for each location (e.g., Manila, Athens)
• Create dynamic device groups by location
• Configure Autopilot for direct shipping to remote employees
• Set local language and time zone in deployment profiles
• Assign local IT staff delegated admin roles
• Configure update rings with local maintenance windows
• Prepare onboarding documentation in local languages
• Verify data residency requirements for each country

Example: Deploying Intune to a 20-Person Remote Office

1. Week 1: Verify internet connectivity and firewall rules at the remote office. Create the location-based device group in Endpoint Manager.
2. Week 2: Ship 5 test devices via Autopilot to pilot users. Have them unbox, power on, and sign in. Verify enrollment and policy application.
3. Week 3: Expand to all 20 users. Distribute Company Portal installation instructions. Push required apps (Office, Teams, VPN).
4. Week 4: Configure Conditional Access policies for the remote office. Enable compliance monitoring. Train local IT contact on using Endpoint Manager reports.

↑ Back to Index

35. Cloud vs. On-Premise File Server – Microsoft 365 File Sharing MS-900

The Core Question: Cloud or Physical Server?

When setting up file sharing for your organization, you have two fundamental approaches: use Microsoft 365 cloud services (SharePoint, OneDrive, Teams) or set up a physical file server with restricted access. This section compares both approaches and provides guidance on when to use each.

Option 1: Cloud File Sharing (Microsoft 365)

SharePoint Online

• What it is: A cloud-based document management and storage system. Teams use it to store and collaborate on files.
• Access: Any device with internet access and a browser. No VPN required.
• Permissions: Granular – site-level, library-level, folder-level, and file-level permissions. Integrates with Microsoft 365 Groups.
• Versioning: Built-in. Automatically keeps versions of every file change (up to 50,000 versions per file).
• Co-authoring: Multiple users can edit the same document simultaneously in real time.
• Storage: 1 TB base + 10 GB per licensed user (e.g., 50 users = 1.5 TB total). Additional storage available.
• Sync: OneDrive sync client lets users sync files to their local machine for offline access.

OneDrive for Business

• What it is: Personal cloud storage for each user. Like a private "cloud drive."
• Access: Web browser, mobile app, or sync to File Explorer.
• Best for: Personal work files, drafts, and files not yet ready to share with the team.
• Sharing: Users can share individual files or folders with colleagues, both inside and outside the organization.

Microsoft Teams (Files Tab)

• What it is: Each Teams channel has a Files tab that stores documents in the underlying SharePoint site.
• Best for: Active collaboration within project teams. Files are accessible directly in the Teams interface.

How to Set Up Cloud File Sharing (Step by Step)

1. Create a SharePoint team site – admin.microsoft.com → SharePoint → Create site → Team site. Name it (e.g., "Company Files").
2. Add members – Add users or security groups. Permissions can be Owners, Members, or Visitors (read-only).
3. Create document libraries – For different departments: "Finance Documents", "HR Documents", "Project Alpha", etc.
4. Set permissions – Break inheritance on libraries to restrict access per department.
5. Upload files – Drag and drop or use the OneDrive sync client.
6. Configure retention policies (optional) – Microsoft Purview → Retention policies → Set retention/deletion rules for files.

Option 2: Physical On-Premise File Server

What it is

A dedicated Windows Server (or NAS device) on your local network that stores shared files. Users connect via mapped network drives (e.g., S: drive, X: drive). Access is controlled through NTFS permissions on the server.

Pros

• Full control – You own the hardware and data entirely, no third-party dependency
• Offline/internet independent – Works even if internet goes down (local network only)
• Large files – Better performance for very large files (video editing, CAD, databases)
• Compliance – Data never leaves your premises, which may satisfy certain regulatory requirements

Cons

• Hardware cost – Server hardware, storage drives, UPS, networking equipment
• Maintenance – OS updates, antivirus, disk replacements, backups, disaster recovery
• No remote access – Requires VPN to access from outside the office (adds complexity and cost)
• No co-authoring – Multiple users cannot edit the same file simultaneously. One user locks the file when editing.
• No versioning – File servers don't automatically track versions. You need manual backup/Shadow Copy.
• Single point of failure – If the server fails, all file access is lost until repaired

Comparison Table: Cloud vs. Physical File Server

Feature	SharePoint / Microsoft 365 Cloud	On-Premise File Server
Initial cost	Included in M365 subscription (no extra hardware)	$2,000-$10,000+ for server hardware
Monthly cost	Part of existing M365 license	Electricity, storage replacements, IT support
Remote access	Anywhere with internet (no VPN)	VPN required (or Remote Desktop)
Co-authoring	✅ Real-time simultaneous editing	❌ One user at a time (file lock)
Version history	✅ Automatic (up to 50,000 versions)	❌ Manual only (Shadow Copy)
Backup & DR	✅ Microsoft handles redundancy	❌ You must manage backups
Offline access	✅ Via OneDrive sync client	✅ Files on local network
File size limit	250 GB per file (SharePoint)	Limited only by disk space
Internet dependency	Requires internet for full functionality	Works fully offline locally
Security control	Microsoft manages infrastructure security	Full control (but you manage it)
Compliance (GDPR, etc.)	Built-in compliance tools (Purview)	You must implement compliance measures
International access	✅ Fast from anywhere with CDN	❌ Slow over VPN from overseas

Recommended Hybrid Approach

For most organizations, the best approach is a hybrid model that uses cloud file sharing for daily collaboration and keeps a server only for specific needs:

Use This	For
SharePoint Online	Departmental files, project collaboration, company-wide document repositories, policies, templates
OneDrive for Business	Personal work files, drafts, files not yet shared with the team
Microsoft Teams	Active project files that the team discusses in Teams channels
On-Premise File Server	Very large media files (video editing, CAD), legacy apps that require mapped drives, archiving old data locally

Setting Up Restricted Access in SharePoint

To restrict sensitive files to specific users (e.g., HR files for HR team only):

1. In SharePoint, navigate to the document library → Settings (gear icon) → Library settings
2. Click Permissions for this document library
3. Click Stop Inheriting Permissions
4. Remove users/groups who should not have access
5. Add only the specific security group (e.g., "HR Team") with appropriate permissions (Contribute, Read, etc.)

# PowerShell: Set unique permissions on a SharePoint library
Connect-PnPOnline -Url "https://company.sharepoint.com/sites/CompanyFiles"
Set-PnPListPermission -Identity "HR Documents" -User "HRTeam@company.com" -AddRole "Contribute"
Remove-PnPListPermission -Identity "HR Documents" -User "Everyone except external users" -Force

Setting Up a Physical File Server with Restricted Access

If you determine you need a physical file server:

# Server Setup Steps:
# 1. Create shared folders on the server
New-Item -ItemType Directory -Path "D:\Shares\Finance" -Force
New-Item -ItemType Directory -Path "D:\Shares\HR" -Force
New-Item -ItemType Directory -Path "D:\Shares\Public" -Force

# 2. Share the folders with appropriate SMB share permissions
New-SmbShare -Name "Finance$" -Path "D:\Shares\Finance" -FullAccess "Domain\Finance Team" -ReadAccess "Domain\Domain Admins"
New-SmbShare -Name "HR$" -Path "D:\Shares\HR" -FullAccess "Domain\HR Team" -ReadAccess "Domain\Domain Admins"
New-SmbShare -Name "Public" -Path "D:\Shares\Public" -ChangeAccess "Domain\Domain Users"

# 3. Set NTFS permissions (more granular)
$acl = Get-Acl "D:\Shares\Finance"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Domain\Finance Team", "Modify", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.SetAccessRule($accessRule)
Set-Acl "D:\Shares\Finance" $acl

# 4. Configure backup
# Use Windows Server Backup or a third-party tool

Migration: Moving from On-Prem File Server to SharePoint

To migrate your existing file shares to SharePoint:

1. Use SharePoint Migration Tool (SPMT) – free tool from Microsoft that migrates files from file shares to SharePoint/OneDrive
2. Map folders: File share folders → SharePoint document libraries (maintains structure)
3. Re-create permissions: NTFS permissions → SharePoint groups/permissions
4. Communicate: Tell users how to access files in the new location (browser, sync client, Teams)
5. Keep the server: Leave the old file server available in read-only for 30-60 days during transition

Quick Decision Tree

• Do you need remote access from anywhere? → Use cloud (SharePoint/OneDrive)
• Do you work with video/CAD/very large files (>10 GB)? → Use physical server
• Do multiple people need to edit the same file at the same time? → Use cloud (co-authoring)
• Is your internet unreliable? → Use physical server (or enable OneDrive offline sync)
• Do you need strict data residency (data must stay in-country on your hardware)? → Use physical server
• Do you have remote offices in other countries? → Use cloud (fast access without VPN)

↑ Back to Index